Shield Claude Skill
Security orchestration for code editor CLIs. Autonomous pentests. Static analysis. Secrets scanning. Dependency audits. One command.
Install / Use
npx skills add alissonlinneker/shield-claude-skillInstalls into whichever agent you are using.
Quality Score
Category
Development & EngineeringSupported Platforms
README
What Shield Does
Shield detects your tech stack, runs every applicable security scanner in parallel, consolidates findings into a single report, calculates a risk score, proposes code fixes, and optionally files GitHub issues -- all without leaving your editor.
+-------------------+
| Shannon Pentest | Proof-by-exploitation, real PoCs
+-------------------+
| Semgrep SAST | 82 custom rules + community rulesets
Your Code --> detect-stack.sh --| gitleaks Secrets | Full git history scan
| Dependency Audit | npm / pip / composer audit
| Freshness Check | Outdated dependency detection
+-------------------+
|
consolidate.sh
|
calculate-score.sh
|
+----------------+----------------+
| | |
Risk Scorecard Fix Proposals GitHub Issues
(0-100) (ready diffs) (per finding)
Quick Start
# 1. Clone and install security tools
git clone https://github.com/alissonlinneker/shield-claude-skill.git
cd shield-claude-skill && ./install.sh
# 2. Register the marketplace in Claude Code (run inside Claude Code)
/plugin marketplace add /path/to/shield-claude-skill
# 3. Install the plugin
/plugin install shield@shield-security
# 4. Open any project and run
/shield:shield
Or for quick testing without marketplace registration:
claude --plugin-dir /path/to/shield-claude-skill
# Then inside Claude Code:
/shield:shield
Features
| Category | Capability | Details | |----------|-----------|---------| | Pentest | Autonomous penetration testing | Full attack-surface analysis via Shannon -- proof-by-exploitation with real PoC payloads | | SAST | Static application security testing | Semgrep with 82 custom rules (12 JS/TS, 11 Python, 11 PHP, 10 Go, 10 Ruby, 8 Rust, 10 Java, 10 C#) plus community rulesets | | Secrets | Secrets scanning | gitleaks detection across entire git history -- keys, tokens, passwords | | SCA | Dependency vulnerability audit | Supports 12 package managers: npm, yarn, pnpm, bun, pip, composer, go, bundler, cargo, maven, gradle, dotnet -- auto-detected by lock file | | Freshness | Dependency outdated check | Detects packages behind on MAJOR, MINOR, and PATCH versions | | Scoring | Security scorecard | Weighted 0-100 risk score with severity breakdown | | Remediation | Fix proposals | Generates before/after diffs you can apply directly | | Baselines | Scan comparison | Tracks improvements and regressions between scans | | Issues | GitHub issue creation | Files issues with severity labels, CWE references, and compliance mappings | | SARIF | Standard output format | SARIF export for GitHub Security tab integration | | Compliance | Compliance mapping | Maps findings to SOC 2, PCI-DSS, and HIPAA controls | | Zero-config | Stack detection | Automatically identifies languages, frameworks, package managers, Docker presence | | Resilience | Graceful degradation | Runs whichever tools are installed, skips the rest, notes gaps in report |
Real Output Examples
Example 1 -- Quick Scan on a Node.js Project
Stack detected: JavaScript, TypeScript, Next.js, React (pnpm)
Security Score: 0/100 — CRITICAL RISK
[ ] 0/100
| Severity | Count |
|----------|-------|
| CRITICAL | 1 |
| HIGH | 20 |
| MEDIUM | 5 |
| LOW | 3 |
Top findings:
[CRITICAL] SHIELD-001: fast-xml-parser regex injection bypass (CWE-185)
Package: fast-xml-parser | Fix: Update to 4.4.1+
[HIGH] SHIELD-002: brace-expansion ReDoS (CWE-1333)
Package: brace-expansion | Fix: Update to 2.0.1+
[HIGH] SHIELD-003: tar hardlink path traversal (CWE-22)
Package: tar | Fix: Update to 6.2.1+
[HIGH] SHIELD-004: micromatch ReDoS via recursive patterns (CWE-1333)
Package: micromatch | Fix: Update to 4.0.8+
Outdated dependencies: 47 packages behind latest
MAJOR: 12 packages (breaking changes, potential security risk)
MINOR: 18 packages (may include security fixes)
PATCH: 17 packages (bug fixes, security patches)
Example 2 -- Clean Scan on a PHP Project
Stack detected: PHP, Laravel, Composer, Docker
Security Score: 100/100 — LOW RISK
[##############################] 100/100
| Severity | Count |
|----------|-------|
| CRITICAL | 0 |
| HIGH | 0 |
| MEDIUM | 0 |
| LOW | 0 |
No vulnerabilities found across all scanners.
All dependencies are up to date.
Example 3 -- Consolidated JSON Output
{
"findings": [
{
"id": "SHIELD-001",
"severity": "CRITICAL",
"title": "SQL Injection in UserRepository",
"cwe": "CWE-89",
"owasp": "A03:2021",
"source_tool": "semgrep",
"file": "src/repositories/user.ts",
"line": 45,
"evidence": "db.query(`SELECT * FROM users WHERE id = ${req.params.id}`)",
"recommendation": "Use parameterized queries",
"status": "new"
}
],
"metadata": {
"scan_date": "2026-03-11",
"scan_timestamp": "2026-03-11T14:30:00Z",
"tools_used": ["semgrep", "gitleaks", "npm-audit"],
"tools_skipped": ["shannon"],
"total_files_scanned": 142
},
"summary": {
"total": 29,
"by_severity": { "critical": 1, "high": 20, "medium": 5, "low": 3 },
"by_tool": { "semgrep": 8, "gitleaks": 0, "npm-audit": 21 },
"by_cwe": { "CWE-89": 1, "CWE-1333": 5, "CWE-22": 3 }
}
}
Example 4 -- Security Scorecard Breakdown
{
"score": 45,
"max_score": 100,
"risk_level": "HIGH",
"breakdown": {
"critical": { "count": 1, "weight": 15, "deduction": 15 },
"high": { "count": 3, "weight": 8, "deduction": 24 },
"medium": { "count": 4, "weight": 3, "deduction": 12 },
"low": { "count": 4, "weight": 1, "deduction": 4 }
},
"total_deduction": 55,
"total_findings": 12
}
Modes
| Mode | Command | Description |
|------|---------|-------------|
| Full | /shield:shield full | Complete assessment -- Shannon pentest + SAST + secrets + SCA + freshness + scorecard |
| Quick | /shield:shield quick | Fast scan -- SAST + secrets + dependency audit + freshness (no pentest) |
| Fix | /shield:shield fix | Auto-remediation -- analyzes findings and generates ready-to-apply diffs |
| Verify | /shield:shield verify | Re-scan after fixes -- confirms issues are resolved, compares against baseline |
| Score | /shield:shield score | Scorecard only -- calculates risk score from last scan or fresh data |
| Outdated | /shield:shield outdated | Dependency freshness check -- lists all outdated packages by severity tier |
| Audit | /shield:audit | Intelligence analysis -- attack chains, false positives, logic vulns, IaC review. No tools required |
Security Auditor — Intelligence Layer
Shield runs the tools. The Security Auditor provides the brain.
/shield:shield quick # Step 1: scan with tools
/shield:audit # Step 2: deep analysis with reasoning
Or use the auditor standalone on any file — no scan needed:
/shield:audit src/auth.py # Code audit
/shield:audit Dockerfile # IaC security review
/shield:audit terraform/ # Infrastructure review
What Shield vs Security Auditor covers
| Capability | /shield:shield | /shield:audit |
|-----------|:-:|:-:|
| Semgrep SAST (82 rules) | Runs the tool | Confirms, explains, provides full fix code |
| Secrets (git history) | gitleaks scan | Inline + config file detection |
| Dependency CVEs | npm/pip/composer audit | Explains exploitability context |
| Autonomous pentest | Shannon | Manual reasoning layer |
| IaC security (Docker/k8s/Terraform/CI) | -- | Full checklist-based review |
| Logic vulnerabilities (IDOR, race conditions) | -- | Business logic analysis |
| Architecture / threat model | -- | Trust boundaries, attack surface mapping |
| Attack chain narrative | -- | End-to-end exploitation story |
| False positive analysis | -- | Context-aware confirmation |
| No tools required | Needs installs | Works anywhere |
Score adjustment
When the auditor runs after Shield, it adjusts the risk score:
Shield score: 62/100
Logic vulnerabilities: -15 (1 IDOR found, not detectable by Semgrep)
False positives removed: +8 (SHIELD-023, SHIELD-031 confirmed FP)
Adju
Related Skills
node-connect
385.5kDiagnose OpenClaw Android, iOS, or macOS node pairing, QR/setup code, route, auth, and connection failures.
blender-python-addon
40.5kBlender Python add-on rules for operators, panels, properties, registration, testing, and API-safe scripting
flutter-development-guidelines-cursorrules-prompt-file
40.5kCursor rules for Flutter development with MVVM architecture, Riverpod state management, Material widgets, and Dart style guidelines.
commit-push-pr
140.7kCommit, push, and open a PR
